Generating Transferrable Adversarial Examples via Local Mixing and Spatially Regularized Logit Optimization for Remote Sensing Object Recognition
摘要
Deep Neural Networks (DNNs) are vulnerable to adversarial attacks, posing significant security threats to their deployment in remote sensing applications. Research on adversarial attacks not only reveals model vulnerabilities but also provides critical insights for enhancing robustness and resilience. Although current mixing-based strategies have been proposed to increase the transferability of adversarial examples, they either perform global blending or directly exchange a region in the images, which may destroy the global semantic features of the images and mislead the optimization direction of adversarial examples. Furthermore, their reliance on cross-entropy loss for perturbation optimization leads to gradient diminishing during iterative updates, directly compromising adversarial example quality. To address these limitations, we focus on non-targeted attacks and propose a novel framework via local mixing and spatially regularized logit optimization for generating transferable adversarial examples in remote sensing object recognition. First, we present a local mixing strategy to generate diverse yet semantically consistent inputs during the generation of adversarial examples. Different from the typical MixUp method which globally blends two images and the MixCut method which stitches different images together, the proposed local mixing method merely blends local regions of two images to preserve as much of the global semantic information as possible. Second, we propose a spatially regularized logistic regression optimization, which combines the advantages of the logistic regression bound-based objective function with a spatial regularization term. Extensive experiments on FGSCR-42 and MTARSI datasets demonstrate superior performance over 12 state-of-the-art methods across 6 surrogate models. Notably, with ResNet as the surrogate model on MTARSI, our method achieves a 17.28% average improvement in black-box attack success rate.